{"id":"CVE-2026-69219","aliases":["CLSA-2026-1788776288","CLSA-2026-1789206834","CLSA-2026-1789372046","CLSA-2026-1791960546","CLSA-2026-1792591661","CLSA-2026-1792591801","CLSA-2026-1792592134","CLSA-2026-1792592159","CLSA-2026-1792592430","CLSA-2026-1792592628","CLSA-2026-1792593109","CLSA-2026-1792593187","CLSA-2026-1792593562","CLSA-2026-1792593590","DEBIAN-CVE-2026-69219","EUVD-2026-61041","GHSA-5m9f-rphj-c435","GHSA-5xwg-cfvj-gff5","GHSA-68mj-5wr7-6fgg","GHSA-6g32-pxv4-2wfj","GHSA-7822-rcf6-97fx","GHSA-93j5-89vc-pph4","GHSA-cqgh-8p3p-mx4m","GHSA-h6w7-qmcm-q6xr","GHSA-qx7j-jv8m-fppr","OESA-2026-4112","RHLW-2026-45242cd5d8021673","RHLW-2026-f4441c6bf0c89319","ROOT-APP-MAVEN-CVE-2026-69219","UBUNTU-CVE-2026-69219"],"status":"published","title":"RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of service. This issue is fixed in version 5.33.1.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00725,"percentile":0.54536,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-789"],"published":"2026-08-18T16:23:32Z","modified":"2026-11-06T19:30:03Z","fixes":[{"ecosystem":"Maven","package":"com.rabbitmq:amqp-client","fixed_in":["5.33.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"com.rabbitmq:amqp-client","fixed_in":["5.30.0-tuxcare.1","5.22.0-tuxcare.1","5.26.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"com.rabbitmq:amqp-client","fixed_in":["5.30.0-aikido.1","5.25.0-aikido.2","5.27.1-aikido.1","5.27.1-aikido.3","5.27.1-aikido.2","5.30.0-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.rabbitmq:amqp-client","fixed_in":["5.30.0-root.io.1","5.25.0-root.io.2","5.27.1-root.io.1","5.27.1-root.io.3","5.27.1-root.io.2","5.30.0-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.33.0"},{"fixed":"5.33.1"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.19.0"},{"fixed":"5.19.0-tuxcare.1"}]}],"versions":["5.19.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.21.0"},{"fixed":"5.21.0-tuxcare.1"}]}],"versions":["5.21.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.30.0"},{"fixed":"5.30.0-tuxcare.1"}]}],"versions":["5.30.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.20.0"},{"fixed":"5.20.0-tuxcare.1"}]}],"versions":["5.20.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.3"},{"fixed":"5.7.3-tuxcare.1"}]}],"versions":["5.7.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.16.1"},{"fixed":"5.16.1-tuxcare.1"}]}],"versions":["5.16.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.0"},{"fixed":"5.18.0-tuxcare.1"}]}],"versions":["5.18.0"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.9.0"},{"fixed":"5.9.0-tuxcare.1"}]}],"versions":["5.9.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.13.1"},{"fixed":"5.13.1-tuxcare.1"}]}],"versions":["5.13.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.14.3"},{"fixed":"5.14.3-tuxcare.1"}]}],"versions":["5.14.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.3"},{"fixed":"5.4.3-tuxcare.1"}]}],"versions":["5.4.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.3"},{"fixed":"5.5.3-tuxcare.1"}]}],"versions":["5.5.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.22.0"},{"fixed":"5.22.0-tuxcare.1"}]}],"versions":["5.22.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.26.0"},{"fixed":"5.26.0-tuxcare.1"}]}],"versions":["5.26.0"]},{"source":"osv","ecosystem":"Debian:12","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1.1","5.0.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1.1","5.0.0-2"]},{"source":"osv","ecosystem":"Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.33.1"}]}],"versions":["1.3.0","1.5.4","1.5.5","1.6.0","1.7.2","1.8.0","1.8.1","2.0.0","2.1.0","2.1.1","2.2.0","2.3.0","2.3.1","2.4.1","2.5.0","2.5.1","2.6.0","2.6.1","2.7.0","2.7.1","2.8.0","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","4.0.0","4.0.1","4.0.2","4.0.3","4.1.0","4.1.1","4.10.0","4.11.0","4.11.1","4.11.2","4.11.3","4.12.0","4.2.0","4.2.1","4.2.2","4.3.0","4.4.0","4.4.1","4.4.2","4.5.0","4.6.0","4.7.0","4.8.0","4.8.1","4.8.2","4.8.3","4.9.0","4.9.1","4.9.2","4.9.3","5.0.0","5.1.0","5.1.1","5.1.2","5.10.0","5.11.0","5.12.0","5.13.0","5.13.1","5.14.0","5.14.1","5.14.2","5.14.3","5.15.0","5.16.0","5.16.1","5.17.0","5.17.1","5.18.0","5.19.0","5.2.0","5.20.0","5.21.0","5.22.0","5.23.0","5.24.0","5.25.0","5.26.0","5.27.0","5.27.1","5.28.0","5.29.0","5.3.0","5.30.0","5.31.0","5.32.0","5.33.0","5.4.0","5.4.1","5.4.2","5.4.3","5.5.0","5.5.1","5.5.2","5.5.3","5.6.0","5.7.0","5.7.1","5.7.2","5.7.3","5.8.0","5.9.0"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-4.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-4.oe2403sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-2.oe2003sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-4.oe2203sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-4.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.25.0.rhlw-00028"}]}],"versions":["1.3.0","1.5.4","1.5.5","1.6.0","1.7.2","1.8.0","1.8.1","2.0.0","2.1.0","2.1.1","2.2.0","2.3.0","2.3.1","2.4.1","2.5.0","2.5.1","2.6.0","2.6.1","2.7.0","2.7.1","2.8.0","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","4.0.0","4.0.1","4.0.2","4.0.3","4.1.0","4.1.1","4.10.0","4.11.0","4.11.1","4.11.2","4.11.3","4.12.0","4.2.0","4.2.1","4.2.2","4.3.0","4.4.0","4.4.1","4.4.2","4.5.0","4.6.0","4.7.0","4.8.0","4.8.1","4.8.2","4.8.3","4.9.0","4.9.1","4.9.2","4.9.3","5.0.0","5.1.0","5.1.1","5.1.2","5.10.0","5.11.0","5.12.0","5.13.0","5.13.1","5.14.0","5.14.1","5.14.2","5.14.3","5.15.0","5.16.0","5.16.1","5.17.0","5.17.1","5.18.0","5.19.0","5.2.0","5.20.0","5.21.0","5.22.0","5.23.0","5.24.0","5.25.0","5.3.0","5.4.0","5.4.1","5.4.2","5.4.3","5.5.0","5.5.1","5.5.2","5.5.3","5.6.0","5.7.0","5.7.1","5.7.2","5.7.3","5.8.0","5.9.0"],"bundled":9},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.30.0"},{"fixed":"5.30.0.rhlw-00016"}]}],"versions":["5.30.0"],"bundled":9},{"source":"osv","ecosystem":"Root:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-aikido.1"},{"fixed":"5.25.0-aikido.2"},{"fixed":"5.27.1-aikido.1"},{"fixed":"5.27.1-aikido.3"},{"fixed":"5.27.1-aikido.2"},{"fixed":"5.30.0-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-root.io.1"},{"fixed":"5.25.0-root.io.2"},{"fixed":"5.27.1-root.io.1"},{"fixed":"5.27.1-root.io.3"},{"fixed":"5.27.1-root.io.2"},{"fixed":"5.30.0-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1.1","5.0.0-2"]}],"products":[{"vendor":"rabbitmq","product":"rabbitmq-java-client"}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-68mj-5wr7-6fgg","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2007","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2008","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/388209356c6478088efce4d8a07b68e73837a7a0","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/6a87a8dcdc8b4cc4b961a7cdd388276446e5dfb2","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-68mj-5wr7-6fgg","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69219.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69219","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-69219","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4112","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46120","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61634","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63335","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63336","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69220","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.37.0","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106121.json","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-cqgh-8p3p-mx4m","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106121","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41","tags":["fix"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2100","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-cqgh-8p3p-mx4m","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.36.0","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106122.json","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-7822-rcf6-97fx","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106122","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/b8bd750fa8c90690e859b18d6343b34421309020","tags":["fix"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2065","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-7822-rcf6-97fx","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.35.0","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106123.json","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-h6w7-qmcm-q6xr","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106123","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/daca1875cdb8b8c0acce78f71103b21a05478446","tags":["fix"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2052","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-h6w7-qmcm-q6xr","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.0","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61634.json","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5xwg-cfvj-gff5","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/08790f09686173eb17b48d08a25edcb32e71a591","tags":["fix"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/b491075f42e89967610c40beded68d3680cfd472","tags":["fix"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/1994","tags":["fix"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/1995","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-5xwg-cfvj-gff5","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.31.0","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63335.json","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-qx7j-jv8m-fppr","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322","tags":["fix"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b","tags":["fix"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/1959","tags":["fix"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/1960","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-qx7j-jv8m-fppr","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63336.json","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5m9f-rphj-c435","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","tags":["fix"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","tags":["fix"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/1999","tags":["fix"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2001","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-5m9f-rphj-c435","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63337.json","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-6g32-pxv4-2wfj","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63337","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/0032f75f9dc3df847f94b2b85a16119250bf63cb","tags":["fix"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/9f8e7efd0c648f235dc0e96232ae7efa75ea4fa8","tags":["fix"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2000","tags":["fix"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2002","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-6g32-pxv4-2wfj","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69220.json","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-93j5-89vc-pph4","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/09af76fce136f3136931654a0a1d43095c80e2f0","tags":["fix"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/db89e34809fbc6ba4e946615f297f3684ccd0acc","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-93j5-89vc-pph4","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-69219","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69219","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-69219","title":"RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of service. This issue is fixed in version 5.33.1.","status":"published","published":"2026-08-18T16:23:32.097Z","modified":"2026-08-19T14:51:36.499Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T13:50:16.178634Z"}],"euvd":[{"id":"EUVD-2026-61041","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of service. This issue is fixed in version 5.33.1.","status":"published","published":"2026-08-18T16:23:32Z","modified":"2026-08-19T14:51:36Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:44.906351Z"}],"ghsa":[{"id":"GHSA-68mj-5wr7-6fgg","title":"RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation","description":"## Summary\n\n`ValueReader.readBytes()` allocates a byte array sized by a wire-declared content length without validating it against actual frame data. A malicious AMQP peer triggers OOM by declaring a ~2GB string/bytes field.\n\n## Vulnerable Code\n\n`src/main/java/com/rabbitmq/client/impl/ValueReader.java` lines 83-95:\n\n```java\nprivate static byte[] readBytes(final DataInputStream in) throws IOException {\n    final long contentLength = unsignedExtend(in.readInt());\n    if(contentLength \u003c Integer.MAX_VALUE) {\n        final byte[] buffer = new byte[(int)contentLength];  // allocates before reading\n        in.readFully(buffer);\n        return buffer;\n    }\n}\n```\n\n## Attack Scenario\n\nA malicious AMQP server sends a LongString field (type tag 'S') with declared length `0x7FFFFFFE` (2,147,483,646). The check `contentLength \u003c Integer.MAX_VALUE` passes. `new byte[2147483646]` attempts ~2GB allocation, causing `OutOfMemoryError` before `readFully()` attempts to read data.\n\nThe allocation size is attacker-controlled and is NOT validated against the frame size or `TruncatedInputStream` bounds. Exploitable pre-authentication via `connection.start` server-properties table.\n\n## Impact\n\nDenial of service via JVM `OutOfMemoryError`. Crashes the entire JVM.\n\n## CWE\n\nCWE-789: Memory Allocation with Excessive Size Value\n\n## Remediation\n\nValidate `contentLength` against the frame's remaining bytes or the negotiated max frame size (default 131,072) before allocating.","status":"published","published":"2026-08-18T16:32:20Z","modified":"2026-08-18T16:32:22Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:41:01.23108Z"}],"nvd":[{"id":"CVE-2026-69219","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of service. This issue is fixed in version 5.33.1.","status":"published","published":"2026-08-18T17:17:01.353Z","modified":"2026-10-22T22:10:00.25Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:12:38.976695Z"}],"osv":[{"id":"CVE-2026-69219","title":"RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of service. This issue is fixed in version 5.33.1.","status":"published","published":"2026-08-18T16:23:32.097Z","modified":"2026-10-28T10:55:15.533650129Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"DEBIAN-CVE-2026-69219","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of service. This issue is fixed in version 5.33.1.","status":"published","published":"2026-08-18T17:17:01.353Z","modified":"2026-10-23T17:47:44.093172814Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"GHSA-68mj-5wr7-6fgg","title":"RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation","description":"## Summary\n\n`ValueReader.readBytes()` allocates a byte array sized by a wire-declared content length without validating it against actual frame data. A malicious AMQP peer triggers OOM by declaring a ~2GB string/bytes field.\n\n## Vulnerable Code\n\n`src/main/java/com/rabbitmq/client/impl/ValueReader.java` lines 83-95:\n\n```java\nprivate static byte[] readBytes(final DataInputStream in) throws IOException {\n    final long contentLength = unsignedExtend(in.readInt());\n    if(contentLength \u003c Integer.MAX_VALUE) {\n        final byte[] buffer = new byte[(int)contentLength];  // allocates before reading\n        in.readFully(buffer);\n        return buffer;\n    }\n}\n```\n\n## Attack Scenario\n\nA malicious AMQP server sends a LongString field (type tag 'S') with declared length `0x7FFFFFFE` (2,147,483,646). The check `contentLength \u003c Integer.MAX_VALUE` passes. `new byte[2147483646]` attempts ~2GB allocation, causing `OutOfMemoryError` before `readFully()` attempts to read data.\n\nThe allocation size is attacker-controlled and is NOT validated against the frame size or `TruncatedInputStream` bounds. Exploitable pre-authentication via `connection.start` server-properties table.\n\n## Impact\n\nDenial of service via JVM `OutOfMemoryError`. Crashes the entire JVM.\n\n## CWE\n\nCWE-789: Memory Allocation with Excessive Size Value\n\n## Remediation\n\nValidate `contentLength` against the frame's remaining bytes or the negotiated max frame size (default 131,072) before allocating.","status":"published","published":"2026-08-18T16:32:20Z","modified":"2026-09-10T03:51:13.151154373Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"OESA-2026-4112","title":"rabbitmq-java-client security update","description":"The library allows Java code to interface to AMQP servers. Please see the specification page for more information on AMQP inter-operation and standards-conformance You will need an AMQP server, such as our very own RabbitMQ server, to use with the client library.\r\n\r\nSecurity Fix(es):\n\nThe RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects.  Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from  DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.(CVE-2023-46120)\n\nThe RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP frame_max value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and NettyFrameHandlerFactory continue to validate broker-controlled frame payload lengths against maxInboundMessageBodySize because the negotiated limit is not applied consistently through setMaxInboundFramePayloadSize. A malicious or compromised broker can send a method frame larger than the negotiated frame_max during or after connection establishment, causing the client to allocate and decode a protocol-invalid frame instead of rejecting it with MalformedFrameException. The protocol violation can disrupt the affected connection and cause client-side denial of service. This issue is fixed in version 5.33.0.(CVE-2026-61634)\n\nThe RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose remainingBodyBytes value is smaller than a following AMQP.FRAME_BODY payload. CommandAssembler.consumeBodyFrame subtracts the peer-controlled payload length before validating that it fits, drives remainingBodyBytes negative, and throws a raw UnsupportedOperationException instead of MalformedFrameException. A malicious or compromised broker peer can send this malformed sequence on an open nonzero channel to terminate frame processing and close the client connection, causing denial of service for work using that connection. This issue is fixed in version 5.31.0.(CVE-2026-63335)\n\nThe RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol() and ConnectionFactory.useSslProtocol(String) configure com.rabbitmq.client.TrustEverythingTrustManager and leave hostname verification disabled, causing arbitrary server certificates, including self-signed certificates, to be accepted. A network attacker able to intercept a TLS connection can impersonate the RabbitMQ broker, read protected AMQP traffic, and modify traffic without certificate or hostname validation. The fix changes the production TLS helpers to use the JVM default trust store and enables hostname verification, while retaining an explicitly named development-only no-verification helper. This issue is fixed in version 5.33.0.(CVE-2026-63336)\n\nThe RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of service. This issue is fixed in version 5.33.1.(CVE-2026-69219)\n\nThe RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively for AMQP table type F and AMQP array type A values without a nesting-depth limit. A malicious AMQP server or network intermediary can send approximately 580 nested table levels in the pre-authentication connection.start frame, fitting within the default 131072-byte frame maximum, to trigger StackOverflowError. The error terminates the client input processing thread and causes denial of service. This issue is fixed in version 5.33.1.(CVE-2026-69220)","status":"published","published":"2026-09-25T01:28:35Z","modified":"2026-09-25T01:45:14.100685852Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHLW-2026-45242cd5d8021673","title":"Lightwell Security Advisory: amqp-client 5.25.0.rhlw-00028","description":"Red Hat Lightwell has released com.rabbitmq:amqp-client 5.25.0.rhlw-00028 with backported fixes for CVE-2026-106121, CVE-2026-106122, CVE-2026-106123, CVE-2026-61634, CVE-2026-63335, CVE-2026-63336, CVE-2026-63337, CVE-2026-69219, and CVE-2026-69220.\n\nCVE-2026-106121: RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS\n\nCVE-2026-106122: RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers\n\nCVE-2026-106123: RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()\n\nCVE-2026-61634: RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max\n\nCVE-2026-63335: RabbitMQ Java client malformed body frame triggers raw command assembler exception\n\nCVE-2026-63336: RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM\n\nCVE-2026-63337: RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading\n\nCVE-2026-69219: RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation\n\nCVE-2026-69220: RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS\n\nThis patched artifact is a drop-in replacement for com.rabbitmq:amqp-client 5.25.0 from Maven Central.","status":"published","published":"2026-11-06T07:10:10Z","modified":"2026-11-06T19:43:09.621680338Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T20:08:20.701853Z"},{"id":"RHLW-2026-f4441c6bf0c89319","title":"Lightwell Security Advisory: amqp-client 5.30.0.rhlw-00016","description":"Red Hat Lightwell has released com.rabbitmq:amqp-client 5.30.0.rhlw-00016 with backported fixes for CVE-2026-106121, CVE-2026-106122, CVE-2026-106123, CVE-2026-61634, CVE-2026-63335, CVE-2026-63336, CVE-2026-63337, CVE-2026-69219, and CVE-2026-69220.\n\nCVE-2026-106121: RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS\n\nCVE-2026-106122: RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers\n\nCVE-2026-106123: RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()\n\nCVE-2026-61634: RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max\n\nCVE-2026-63335: RabbitMQ Java client malformed body frame triggers raw command assembler exception\n\nCVE-2026-63336: RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM\n\nCVE-2026-63337: RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading\n\nCVE-2026-69219: RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation\n\nCVE-2026-69220: RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS\n\nThis patched artifact is a drop-in replacement for com.rabbitmq:amqp-client 5.30.0 from Maven Central.","status":"published","published":"2026-11-05T13:47:45Z","modified":"2026-11-06T19:43:11.389328771Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T20:08:20.701853Z"},{"id":"UBUNTU-CVE-2026-69219","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of service. This issue is fixed in version 5.33.1.","status":"published","published":"2026-08-18T17:17:00Z","modified":"2026-10-17T12:59:29.199681042Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:57.159276Z"},{"id":"CLSA-2026-1788776288","title":"TuxCare security update for com.rabbitmq:amqp-client (2 CVEs)","description":"TuxCare rebuilt com.rabbitmq:amqp-client to address 2 CVEs. Fixed in 5.19.0-tuxcare.1.","status":"published","published":"2026-09-07T10:18:08Z","modified":"2026-10-15T09:47:42.891505613Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789206834","title":"TuxCare security update for com.rabbitmq:amqp-client (3 CVEs)","description":"TuxCare rebuilt com.rabbitmq:amqp-client to address 3 CVEs. Fixed in 5.21.0-tuxcare.1.","status":"published","published":"2026-09-12T09:53:54Z","modified":"2026-10-15T09:47:26.166974543Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789372046","title":"TuxCare security update for com.rabbitmq:amqp-client (1 CVE)","description":"TuxCare rebuilt com.rabbitmq:amqp-client to address 1 CVE. Fixed in 5.30.0-tuxcare.1.","status":"published","published":"2026-09-14T07:47:26Z","modified":"2026-10-15T09:47:43.048354682Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1791960546","title":"TuxCare security update for com.rabbitmq:amqp-client (3 CVEs)","description":"TuxCare rebuilt com.rabbitmq:amqp-client to address 3 CVEs. Fixed in 5.20.0-tuxcare.1.","status":"published","published":"2026-10-14T06:49:06Z","modified":"2026-10-15T09:45:53.371971858Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792591661","title":"TuxCare security update for com.rabbitmq:amqp-client (4 CVEs)","description":"TuxCare rebuilt com.rabbitmq:amqp-client to address 4 CVEs. Fixed in 5.7.3-tuxcare.1.","status":"published","published":"2026-10-21T14:07:41Z","modified":"2026-10-21T20:30:04.681834888Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792591801","title":"TuxCare security update for com.rabbitmq:amqp-client (4 CVEs)","description":"TuxCare rebuilt com.rabbitmq:amqp-client to address 4 CVEs. Fixed in 5.16.1-tuxcare.1.","status":"published","published":"2026-10-21T14:10:01Z","modified":"2026-10-21T20:30:03.214905757Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792592134","title":"TuxCare security update for com.rabbitmq:amqp-client (4 CVEs)","description":"TuxCare rebuilt com.rabbitmq:amqp-client to address 4 CVEs. Fixed in 5.18.0-tuxcare.1.","status":"published","published":"2026-10-21T14:15:34Z","modified":"2026-10-21T20:30:03.720716971Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792592159","title":"TuxCare security update for com.rabbitmq:amqp-client (3 CVEs)","description":"TuxCare rebuilt com.rabbitmq:amqp-client to address 3 CVEs. Fixed in 5.9.0-tuxcare.1.","status":"published","published":"2026-10-21T14:15:59Z","modified":"2026-10-21T20:30:04.619050372Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792592430","title":"TuxCare security update for com.rabbitmq:amqp-client (3 CVEs)","description":"TuxCare rebuilt com.rabbitmq:amqp-client to address 3 CVEs. Fixed in 5.13.1-tuxcare.1.","status":"published","published":"2026-10-21T14:20:30Z","modified":"2026-10-21T20:30:03.828647678Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792592628","title":"TuxCare security update for com.rabbitmq:amqp-client (3 CVEs)","description":"TuxCare rebuilt com.rabbitmq:amqp-client to address 3 CVEs. Fixed in 5.14.3-tuxcare.1.","status":"published","published":"2026-10-21T14:23:48Z","modified":"2026-10-21T20:30:06.171486267Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792593109","title":"TuxCare security update for com.rabbitmq:amqp-client (4 CVEs)","description":"TuxCare rebuilt com.rabbitmq:amqp-client to address 4 CVEs. Fixed in 5.4.3-tuxcare.1.","status":"published","published":"2026-10-21T14:31:49Z","modified":"2026-10-27T13:43:05.695750304Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792593187","title":"TuxCare security update for com.rabbitmq:amqp-client (4 CVEs)","description":"TuxCare rebuilt com.rabbitmq:amqp-client to address 4 CVEs. Fixed in 5.5.3-tuxcare.1.","status":"published","published":"2026-10-21T14:33:07Z","modified":"2026-10-27T13:43:10.368637201Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792593562","title":"TuxCare security update for com.rabbitmq:amqp-client (1 CVE)","description":"TuxCare rebuilt com.rabbitmq:amqp-client to address 1 CVE. Fixed in 5.22.0-tuxcare.1.","status":"published","published":"2026-10-21T14:39:22Z","modified":"2026-10-21T20:30:05.674768939Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792593590","title":"TuxCare security update for com.rabbitmq:amqp-client (1 CVE)","description":"TuxCare rebuilt com.rabbitmq:amqp-client to address 1 CVE. Fixed in 5.26.0-tuxcare.1.","status":"published","published":"2026-10-21T14:39:50Z","modified":"2026-10-21T20:30:03.334180177Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-69219","title":"CVE-2026-69219 in com.rabbitmq:amqp-client - Patched by Root","description":"Root has patched CVE-2026-69219 in the com.rabbitmq:amqp-client package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-13T12:14:22Z","modified":"2026-10-13T13:15:04.169985546Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}